我正在开展一个学校项目，将打印机的日志发送到splunk。这是由几批学生完成的项目。我最初使用上一批学生完成的rsyslog.conf文件的原始副本，但无法在Splunk中检索数据。 我已经设置了打印机将日志发送到我正在使用的linux服务器的IP地址和端口。 Splunk中的配置也用于收听端口2048. 我的主管告诉我，前一个学生完成的副本应该可以正常工作。
原件复印件：
# rsyslog configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see
http://www.rsyslog.com/doc/troubleshoot.html
#### MODULES ####
# The imjournal module bellow is now used as a message source instead of
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via
logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 2048
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
$template RemoteLogs,"/var/log/syslog/%HOSTNAME%/%FROMHOST-IP%.log"
*.* ?RemoteLogs
#### GLOBAL DIRECTIVES ####
# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on
# File to store the position in the journal
$IMJournalStateFile imjournal.state
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg :omusrmsg:*
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional
#*.* @@remote-host:514
# ### end of the forwarding rule ###
由于我无法让打印机使用上述配置将日志发送到Splunk，我进行了在线研究并进行了一些修改，我设法让打印机将日志发送到Splunk。
修改后的副本：
# rsyslog configuration file
# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see
http://www.rsyslog.com/doc/troubleshoot.html
#### MODULES ####
# The imjournal module bellow is now used as a message source instead of
imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via
logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark # provides --MARK-- message capability
# Provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 2048
*$InputUDPServer BindRuleset remote
$UDPServerRun 2048*
# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514
$template RemoteLogs,"/var/log/syslog/%HOSTNAME%/%FROMHOST-IP%.log"
*.* ?RemoteLogs
#### GLOBAL DIRECTIVES ####
# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog
# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
# File syncing capability is disabled by default. This feature is usually
not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on
# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf
# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on
# File to store the position in the journal
$IMJournalStateFile imjournal.state
**.* action(type="omfwd" target="172.**.***.156" port="2048" protocol="udp"
action.resumeRetryCount="100"
queue.type="linkedList" queue.size="10000")*
#### RULES ####
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.* /dev/console
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none /var/log/messages
# The authpriv file has restricted access.
authpriv.* /var/log/secure
# Log all the mail messages in one place.
mail.* -/var/log/maillog
# Log cron stuff
cron.* /var/log/cron
# Everybody gets emergency messages
*.emerg :omusrmsg:*
# Save news errors of level crit and higher in a special file.
uucp,news.crit /var/log/spooler
# Save boot messages also to boot.log
local7.* /var/log/boot.log
# ### begin forwarding rule ###
# The statement between the begin ... end define a SINGLE forwarding
# rule. They belong together, do NOT split them. If you create multiple
# forwarding rules, duplicate the whole block!
# Remote Logging (we use TCP for reliable delivery)
#
# An on-disk queue is created for this action. If the remote host is
# down, messages are spooled to disk and sent when it is up again.
#$ActionQueueFileName fwdRule1 # unique name prefix for spool files
#$ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
#$ActionQueueSaveOnShutdown on # save messages to disk on shutdown
#$ActionQueueType LinkedList # run asynchronously
#$ActionResumeRetryCount -1 # infinite retries if host is down
*remote host is: 172.**.***.43:2048
*.* @@remote-host:514*
# ### end of the forwarding rule ###
在我做了上述修改后，我能够从打印机接收日志到Splunk 。但是，在我尝试从打印机生成日志几天后，我不再收到Splunk中的新日志。我没有对我一直使用的rsyslog.conf文件的修改副本进行任何更改。因此，我不知道为什么Splunk不再接收来自打印机的日志。
我将配置更改为另一个端口号，但仍未从打印机接收新日志，因此我更改回端口2048.我还仔细检查了我在打印机的EWS中进行了相应的更改Splunk正确。我一直在研究这个问题并对整天进行双重检查，但无济于事。
注意：
-2048是用于从打印机检索日志的端口
-172。**。 ***。43是打印机的IP地址（它代表实际的IP地址，被另一个用户告知要审查它，我没有将astrids作为我的IP地址的一部分放在真实的配置文件中）
-172。**。 ***。156是我正在使用的Linux服务器的IP地址（它代表实际的IP地址，被另一个用户告知要审查它，我没有把astrids作为我的IP地址的一部分放在真实的配置文件中）
- 我正在使用Linux服务器作为我的主要工作点，在修改后的副本中我添加了一个段落，目的地说明我当前的IP地址（linux服务器），这是因为打印机停止向我的服务器发送日志的原因我一直在将日志指向＆＃34;我自己＆＃34; -config使用与目标主机相同的Linux服务器完成 - 也是Linux服务器）
- 带有astrids的文本是我添加到原始副本的文本
-EWS代表嵌入式Web服务，基本上是打印机的Web门户。
- 如何从打印机触发日志：登录到EWS /进行失败的登录。登录详情将发送至Splunk
答案 0 :(得分：0)
您需要将rsyslog和splunk分离并一次关注一个。
假设： 打印机为172.x.x.43，并配置为通过udp 2048将syslog发送到172.x.x.156。 Rsyslog在172.x.x.156上运行，正在监听udp 2048。
确认您能够正确地从打印机生成系统日志消息。 （来自172.x.x.156命令行）
tcpdump -nn | grep 2048
您至少应该看到进入系统的流量。
我会修改rsyslog.conf以仅将打印机信息记录到文件中然后将其丢弃。您目前正在将所有内容放入文件中并将所有内容转发给您自己，但是在您不能收听的端口上...
类似的东西：
if ($fromhost-ip == '172.x.x.43') then {
action(type="omfile" file="/var/log/remotehosts/printers/%fromhost-ip%.log")
stop
}
测试rsyslog配置错误：
rsyslogd -N1
如果好重启rsyslogd。
然后你应该配置splunk转发器来使用该文件。 inputs.conf
[monitor:///var/log/remotehosts/printers/*.log]
sourcetype = printer # or whatever